All Apps and Add-ons

Sideview utils pulldown stopped working after upgrading to Splunk 5

tsmithsplunk
Path Finder

After the Splunk 5 upgrade, a dashboard using a Pulldown module malfunctioned. I'm using Sideview Utils 1.3.5. The specific error msg is "ERROR - Pulldown is configured statically but with only a single static option."

I also get various errors when saving the view:
"Misconfigured view 'uit_usage' - Unknown parameter 'valueField' is defined for module Pulldown. Make sure the parameter is specified in Pulldown.conf."

"Misconfigured view 'uit_usage' - Unknown parameter 'staticOptions' is defined for module Pulldown. Make sure the parameter is specified in Pulldown.conf"

Perhaps Sideview utils needs to be reinstalled?

here's the view xml:

<?xml version='1.0' encoding='utf-8'?>





<module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="clearOnJobDispatch">False</param>
    <param name="maxSize">1</param>
</module>
<module name="Message" layoutPanel="messaging">
    <param name="filter">splunk.search.job</param>
    <param name="clearOnJobDispatch">True</param>
    <param name="maxSize">1</param>
</module>

<module name="TitleBar" layoutPanel="viewHeader">
    <param name="actionsMenuFilter">dashboard</param>
</module>

<module name="SavedSearch" layoutPanel="panel_row1_col1" autoRun="True">
    <param name="name">UIT Usage</param>

    <module name="HTML">

        <param name="html"><![CDATA[
                      <div style="font-weight:bold; font-size:1.2em">Top 30 Orgs by usage over the last 7 days</div>
        ]]></param>
                <!--
                <param name="html"><![CDATA[
                      <div style="font-weight:bold; font-size:1.2em">Top 30 Orgs by usage during the 13.2 UIT period</div>
        ]]></param>
                -->
    </module>

    <module name="Pulldown">
        <param name="name">orgList</param>
        <param name="label">See daily counts by choosing an Org below or from this option list</param>
        <param name="postProcess">dedup applog_orgName | sort applog_orgName</param>
        <param name="valueField">applog_orgName</param>
        <param name="staticOptions"></param>

        <module name="PostProcess" layoutPanel="panel_row1_col1_grp1">
            <param name="search">chart count over applog_orgName | sort 30 count desc</param>

            <module name="HiddenChartFormatter">
                <param name="charting.axisTitleY.text">Organization</param>
                <param name="charting.legend.placement">none</param>
                <param name="charting.chart">bar</param>
                <param name="charting.axisTitleX.text">Number of Commands</param>

                <module name="FlashChart">
                    <param name="width">100%</param>
                    <param name="height">500px</param>

                    <!-- changing the drill down to show daily counts for the selected org -->
                    <module name="PostProcess" layoutPanel="panel_row2_col1">
                        <param name="search">where applog_orgName="$click.value$" | timechart count by applog_orgName span=1h</param>

                        <module name="SimpleResultsHeader">
                            <param name="entityName">results</param>
                            <param name="headerFormat">Daily usage for $click.value$</param>
                        </module>

                        <module name="HiddenChartFormatter">
                            <param name="charting.axisTitleY.text">Commands</param>
                            <param name="charting.legend.placement">none</param>
                            <param name="charting.chart">column</param>
                            <param name="charting.axisTitleX.text">Day</param>

                            <module name="FlashChart">
                                <param name="width">100%</param>
                                <param name="height">200px</param>
                            </module>
                        </module>
                    </module>

                </module>
            </module>
        </module>

        <module name="PostProcess" layoutPanel="panel_row2_col2">
            <param name="search">where applog_orgName="$orgList$" | timechart count by applog_orgName span=1h</param>

            <module name="SimpleResultsHeader">
                <param name="entityName">results</param>
                <param name="headerFormat">Daily usage for $orgList$</param>
            </module>

            <module name="HiddenChartFormatter">
                <param name="charting.axisTitleY.text">Commands</param>
                <param name="charting.legend.placement">none</param>
                <param name="charting.chart">column</param>
                <param name="charting.axisTitleX.text">Day</param>

                <module name="FlashChart">
                    <param name="width">100%</param>
                    <param name="height">200px</param>
                </module>
            </module>
        </module>

    </module>   
</module>

1 Solution

sideview
SplunkTrust
SplunkTrust

Well your view is using params that only exist in Sideview Utils 2.X, so clearly that app has a dependency on Sideview Utils 2.X, and not 1.3.5.

I'm thinking that in your upgrade to Splunk 5, you inadvertently reverted from a recent Sideview Utils to the very old 1.3.5 version?

http://sideviewapps.com/apps/sideview-utils

and if you want to read the release notes you can see valueField and staticOptions in there:
http://sideviewapps.com/apps/sideview-utils/release-notes/

and remember to get on the mailing list so you can get a litlte email when there are new releases.
http://sideviewapps.com/apps/sideview-utils/mailing-list/

View solution in original post

0 Karma

sideview
SplunkTrust
SplunkTrust

Well your view is using params that only exist in Sideview Utils 2.X, so clearly that app has a dependency on Sideview Utils 2.X, and not 1.3.5.

I'm thinking that in your upgrade to Splunk 5, you inadvertently reverted from a recent Sideview Utils to the very old 1.3.5 version?

http://sideviewapps.com/apps/sideview-utils

and if you want to read the release notes you can see valueField and staticOptions in there:
http://sideviewapps.com/apps/sideview-utils/release-notes/

and remember to get on the mailing list so you can get a litlte email when there are new releases.
http://sideviewapps.com/apps/sideview-utils/mailing-list/

0 Karma

tsmithsplunk
Path Finder

That must be it. I looked back in my notes from a year ago when sideview utils was first installed and I had v2.2.2. I have no idea how 1.3.5 got installed. I have informed IT and I'm sure once the new version gets installed things will start working. Many thanks!

0 Karma

tsmithsplunk
Path Finder

Does anyone know if the sideview utils Pulldown module can use a saved search? I've been tinkering with this and it appears like the Pulldown is not recognizing the upstream SavedSearch.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

The Problem: Too Many Alerts, Too Little Context Security operations teams running Splunk Enterprise Security ...

All Work and No Play? Not at .conf26! Unwind at These Evening Events

Between hands-on technical sessions, keynote reveals, and diving into live architectures, .conf26 is packed ...

Join the Hackathon at .conf26 and build a No-Code AI agent

Join us for the AI Agent Buildathon, an in-person, three-hour hands-on Hackathon where you’ll use Splunk Agent ...